{"id":"ghsa-ghsa-xcq7-p3pf-p88h","seq":309579,"kind":"advisory","title":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","url":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-xcq7-p3pf-p88h","summary":"影響: pip:opentelemetry-api <= 1.45.0 → 1.45.1\nTraceState.from_header splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs O(N²) CPU. A single unauthenticated request with a ~100 KB tracestate keeps the handling worker busy for ~6 s (spaces) to ~12 s (tabs); under an asyncio server it blocks every other connection for that time. Affected component / version - Package: opente…","severity":"medium","techs":["python"],"cves":["CVE-2026-114603"],"tags":["GHSA-xcq7-p3pf-p88h","opentelemetry-api"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:22:07.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}